Microsoft 365 Security Updates May 2026: Purview, Entra and Windows 365 for Agents

Two recent announcements (May 2026), released within days of each other, signal where Microsoft 365 security is heading.

Microsoft’s latest security update introduced new capabilities across Purview, Entra and Windows 365 aimed at a single underlying challenge: organisations are rapidly adopting AI tools that interact with Microsoft 365 data and identities. Whether those tools are Microsoft-native services such as Copilot or third-party platforms such as Claude, security teams need governance, visibility and protection that extends across both.

At the same time, Anthropic expanded the ecosystem of integrations available through the Claude Compliance API. Two names on that list will be familiar to anyone running a modern Microsoft 365 stack: Microsoft Purview and Fortinet. Both can now bring Claude activity into existing security, compliance and governance workflows, alongside the other applications already used across the organisation.

For organisations running Microsoft 365, particularly those rolling out Copilot or evaluating third-party AI tools, these updates aren’t isolated product changes. They’re signals about how the Microsoft 365 security model is evolving.

Microsoft Purview now extends visibility to Claude AI usage

The standout integration in this month’s Microsoft 365 security updates is the connection between Microsoft Purview and Anthropic’s Claude. Security and compliance teams can now gain visibility into and investigate Claude Enterprise activity alongside other cloud applications in their broader AI ecosystem. The Claude Compliance API for Microsoft Purview delivers centralised visibility and oversight for Claude Enterprise activity, providing insights into Claude interactions and audit log signals.

For Microsoft 365 customers, this is significant. Purview already handles data security, compliance and risk management across the Microsoft 365 estate. Extending visibility to Claude, alongside Anthropic’s broader ecosystem of compliance integrations, means organisations can increasingly bring AI activity into existing governance processes rather than managing it as a completely separate workstream. For many organisations, the same tools already used to govern Microsoft 365 can now provide oversight of AI activity as well.

New Microsoft Purview DSPM experience is generally available

Microsoft Purview Data Security Posture Management (DSPM) is now generally available with a redesigned experience. DSPM unifies discovery, protection and remediation in a single workflow, allowing security teams to investigate risks and take action without switching between tools.

The new experience delivers goal-oriented flows, deeper remediation, expanded reporting and third-party visibility. For Microsoft 365 environments where sensitive data sits across SharePoint, OneDrive, Teams and Exchange, DSPM provides the scale and automation needed to discover sensitive data, assess risk and act on it consistently.

Purview Data Security Investigations adds OCR and custom examinations

Microsoft Purview Data Security Investigations now includes optical character recognition (OCR) and custom examination capabilities. OCR extracts text from images, bringing visual content (screenshots, photographed documents, signed PDFs, embedded diagrams) into scope for AI-powered content analysis for the first time.

In practice, this closes a long-standing blind spot. Sensitive information shared as an image rather than text has historically slipped past DLP and investigation tools. With OCR in Purview DSI, that content can now be examined alongside everything else. Custom examination capabilities also allow investigators to define their own analysis logic, rather than working only with pre-built examination types.

Microsoft Entra ID Account Recovery restores access securely

Microsoft Entra ID Account Recovery is a new authentication recovery mechanism for users who have lost access to all their registered authentication methods. Unlike traditional password reset, Account Recovery focuses on identity verification and trust re-establishment before replacing authentication methods.

For organisations operating phishing-resistant MFA and strict conditional access, Account Recovery solves the practical problem of how to safely restore access when a user loses their device, token or both. It’s a small update with significant operational impact for IT and security teams.

Windows 365 for Agents creates a secure execution environment for AI

Windows 365 for Agents is now expanding in public preview. Together with Microsoft Agent 365, it provides a consistent, secure environment to run and govern AI agents inside an organisation.

Agent 365 determines what work an agent is authorised to do, using shared organisational policies and identity to govern agent behaviour and access. Windows 365 for Agents defines where the agent executes that work, providing Cloud PCs that let agents operate their own desktops and applications inside a fully managed, auditable environment.

For Microsoft 365 customers planning broader AI agent deployments (whether Copilot, custom agents built on Microsoft Foundry, or third-party agents), this provides the underlying infrastructure to do it without losing visibility or control.

What the Microsoft 365 security updates mean together

Read individually, each of these updates is incremental. Read together, they describe a clear direction for Microsoft 365 security:

Governance is expanding to cover AI workloads natively. Purview now provides visibility and oversight for Claude Enterprise activity. DSPM now operates across the Microsoft 365 estate and incorporates broader visibility across connected platforms. Investigations now include image content. Microsoft is treating AI not as a separate domain but as part of the data and identity surface that already needs protection.

Identity remains the perimeter. Entra Account Recovery, paired with the broader identity capabilities in Defender and Entra, reflects the reality that in a Microsoft 365 environment, the perimeter is the user, the device and the conditional access policy that governs them.

Execution environments matter again. Windows 365 for Agents recognises that secure AI deployment requires not just policy and identity controls, but a managed, auditable place for agents to actually run.

Where Microsoft 365 security is heading beyond 2026

These updates aren’t standalone. They’re part of a multi-year direction worth planning around.

AI governance becomes a Microsoft 365 baseline

Within 12 to 18 months, governing AI activity (whether Copilot, Microsoft Agent 365 or third-party tools like Claude) will be a baseline expectation of any Microsoft 365 security program. Organisations still treating AI as a separate workstream will fall behind organisations that treat it as part of standard data security.

Compliance shifts from periodic to continuous

APIs like the Claude Compliance API, combined with Purview’s DSPM and Defender’s telemetry, are designed for continuous visibility, not point-in-time audits. Microsoft 365 security strategy needs to assume real-time monitoring as the baseline.

Defenders will use AI as aggressively as attackers do

The latest threat reporting (including the Fortinet 2026 Global Threat Landscape Report and the Huntress 2026 Cyber Threat Report) shows attackers industrialising AI for phishing, credential theft and tool abuse. Microsoft, Fortinet and Huntress, our technology partners, are responding by embedding AI into detection, triage and response. Organisations that don’t adopt AI-assisted defence will be defending at human speed against attacks running at machine speed.

Microsoft 365 security priorities to action

For organisations running Microsoft 365, the practical priorities from these updates are clear.

• Audit sensitivity labels and DLP policies with AI access in mind. If Copilot or another AI tool can index data, the existing labels need to be enforcing what they were designed to enforce.
• Enable Purview’s newer capabilities, including the DSPM general availability experience, OCR and custom examinations in Data Security Investigations.
• Review Microsoft Entra conditional access policies for privileged accounts, AI admin roles and access to sensitive SharePoint sites and Teams. Roll out Account Recovery where appropriate.
• Inventory third-party AI tools in use across the business and confirm they can be brought under existing governance, whether through native integrations, the Claude Compliance API or equivalent.
• Plan Windows 365 for Agents into broader AI deployment roadmaps, especially for organisations planning to deploy custom or third-party agents alongside Copilot.

Microsoft 365 Security Consulting support

A1 Technologies is an Australian Microsoft Solutions Partner that helps mid-market and SMB organisations harden their Microsoft 365 environments and align to frameworks like the Essential Eight. Contact our team to discuss how these updates apply to your environment.

Jarrod Taylor

Jarrod Taylor is a Microsoft Engineer at A1 Technologies, a Microsoft consultancy based in Australia. He specialises in the design, implementation, and support of Microsoft-based platforms, applications, and solutions. Jarrod is passionate about delivering exceptional customer service and helping clients get real results from their IT environments.